Changes between Version 1 and Version 2 of Ticket #10259, comment 7


Ignore:
Timestamp:
Nov 28, 2013, 3:41:36 PM (7 years ago)
Author:
ttcoder

Legend:

Unmodified
Added
Removed
Modified
  • Ticket #10259, comment 7

    v1 v2  
    1515- the {{{df077900}}} pointer is surrounded by other, similar values, in what appears to be an array of structs of size 32 bytes: you can see value {{{df077920}}}, {{{df077960}}} ..etc; the memory at address {{{df077920}}} ..etc, is located just below the "wanderer.." string and contains values like {{{801a9fe0}}}; assuming these are legit, this would validate the idea that there used to be a similar value on the three lines above, which were clobbered by the "wanderer.." string (and also the "tcp data" string..?), and the {{{df077900}}} pointer would just be innocent/legit: when it tried to access the pointer there to perform its stop-notifying() chore, the pointer was gone and replaced by 'T - ' instead, an ascii string. Trying to indirect it -> Boom.
    1616- on the other hand, the "- The wanderer..." string seems to be just an strdup()ed string in the middle of other strdup()ed strings (suspiciously close to the bottom "edge" of that bunch of strings tho, but let's suspend disbelief), so maybe it is not out of place, and it is the {{{df077900}}} pointer which has gone bad, or even the whole set of pointers beside it on or about {{{df07c2d0}}} which are out of place.
     17
     18There are more scenarios that one can come up with of course.. For instance a "memory used after being free()d" classic case: maybe the call to strdup() on "jogeir.. wanderer.." (like this one [http://cgit.haiku-os.org/haiku/tree/src/add-ons/kernel/file_systems/cdda/kernel_interface.cpp#n747 here] ) allocates and writes to that 32 bytes chunk of memory after it was mistakenly free() by startwatching/stopwatching et al (which would explain why this bug is hard to reproduce: a 32 bytes string is not going to fit in the same places as a smaller or bigger one, and in a multi-threaded OS it's hard to predict where memory chunks are going to be allocated and in what order, so the free()d memory structure can survive for a long time or a short time depending on butterfly-effect changes...)